Skip to main content

mom: correcting a most troublesome mom 2005 agent...

after a long holiday, the first thing i want to do is jump right into disciplining a bad agent.  i wish i could say it was something really painful to lament over.  unfortunately, it wasn't.  nor exciting.  it was like a cockroach: elusive and slippery.  i couldn't make it go away.  this is probably the third time that various corrective actions were done against this server.

it seems the real issue was wmi corruption.  i have no idea what caused it or how it happened.  i suppose as far as wmi goes it's always a mystery.  anyway, it started off that way.  didn't quite end that way.  some of the errors i was seeing:

The response processor failed to execute a response.  The response returned the error message: The remote procedure call failed.

Response Details:

Rule ID:  {E8665A8F-17B6-4C7C-BA62-CAC4E33C13CD}
Response description: script: AD CPU Overload

The response 'script: AD CPU Overload' has been running more than 300 seconds and exceeded the time allowed to run. 
This might indicate the response is engaged in an infinite loop or is hanging.

An error occurred on line 250 while executing script 'Microsoft Windows File Server SMB counters calculation'
Source: SWbemRefresher
Description: Invalid class

 

and now... the things i did to fix it:

  1. repair wmi:
    • Rundll32 wbemupgd, CheckWMISetup
    • Rundll32 wbemupgd, RepairWMISetup
  2. register all wmi components:
    • cd /d %windir%\system32\wbem
    • for %i in (*.dll) do RegSvr32 -s %i
    • for %i in (*.exe) do %i /RegServer
  3. resync wmi performance counters:
    • winmgmt /clearadap
    • winmgmt /resyncperf
  4. recompile all mofs:
    • cd /d %windir%\system32\wbem
    • for /r %i in (*.mof *.mfl) do mofcomp %i
  5. reinstall the mom agent (just to make sure all components are placed back into wmi correctly)

 

after running all of the above steps, i still encountered mom errors where script executions continued to fail.  the next step is a bit unusual because everything in the environment suggests that it doesn't need to be done.  i verified that we were running at least patch 11 (which supposedly addresses this issue) as noted in this article.  since it still continued to fail, i checked out the scriptscan settings to verify that it was turned off.  after verifying both of those things, i decided... what the hell?  i'll just unregister it.  so i did...

 

  1. unregister mcafee 8.0i scriptproxy.dll:
  • cd /d %programfiles%\network associates\virusscan
  • regsvr32 –u scriptproxy.dll

 

and now... it finally works.

Labels:

Comments

Post a Comment

Popular posts from this blog

using preloadpkgonsite.exe to stage compressed copies to child site distribution points

UPDATE: john marcum sent me a kind email to let me know about a problem he ran into with preloadpkgonsite.exe in the new SCCM Toolkit V2 where under certain conditions, packages will not uncompress.  if you are using the v2 toolkit, PLEASE read this blog post before proceeding.   here’s a scenario that came up on the mssms@lists.myitforum.com mailing list. when confronted with a situation of large packages and wan links, it’s generally best to get the data to the other location without going over the wire. in this case, 75gb. :/ the “how” you get the files there is really not the most important thing to worry about. once they’re there and moved to the appropriate location, preloadpkgonsite.exe is required to install the compressed source files. once done, a status message goes back to the parent server which should stop the upstream server from copying the package source files over the wan to the child site. anyway, if it’s a relatively small amount of packages, you can
11 comments
more »

How to Identify Applications Using Your Domain Controller

Problem Everyone has been through it. We've all had to retire or replace a domain controller at some point in our checkered collective experiences. While AD provides very intelligent high availability, some applications are just plain dumb. They do not observe site awareness or participate in locating a domain controller. All they want is the name or IP of one domain controller which gets hardcoded in a configuration file somewhere, deeply embedded in some file folder or setting that you are never going to find. How do you look at a DC and decide which applications might be doing it? Packet trace? Logs? Shut it down and wait for screaming? It seems very tedious and nearly impossible. Potential Solution Obviously I wouldn't even bother posting this if I hadn't run across something interesting. :) I ran across something in draftcalled Domain Controller Isolation. Since it's in draft, I don't know that it's published yet. HOWEVER, the concept is based off
3 comments
more »

sccm: content hash fails to match

back in 2008, I wrote up a little thing about how distribution manager fails to send a package to a distribution point . even though a lot of what I wrote that for was the failure of packages to get delivered to child sites, the result was pretty much the same. when the client tries to run the advertisement with an old package, the result was a failure because of content mismatch. I went through an ordeal recently capturing these exact kinds of failures and corrected quite a number of problems with these packages. the resulting blog post is my effort to capture how these problems were resolved. if nothing else, it's a basic checklist of things you can use.   DETECTION status messages take a look at your status messages. this has to be the easiest way to determine where these problems exist. unfortunately, it requires that a client is already experiencing problems. there are client logs you can examine as well such as cas, but I wasn't even sure I was going to have enough m
3 comments
more »